What ZMap Project does

The ZMap Project is a non-commercial, academic open-source initiative founded in 2013 at the University of Michigan by Zakir Durumeric, Eric Wustrow, and J. Alex Halderman to enable Internet-scale measurement studies. Its core offering is a modular toolchain written primarily in Go and C: the flagship ZMap scanner can survey the entire public IPv4 address space on a single port in under 45 minutes from a single gigabit-connected machine, with companion tools ZGrab (stateful application-layer scanner covering HTTP, HTTPS, SSH, Telnet, FTP, SMTP, POP3, IMAP, Modbus, BACNET, Siemens S7, and Tridium Fox), ZDNS (high-throughput DNS lookup utility with its own recursive resolver), LZR (protocol-identification shim), ZCrypto (TLS/X.509 library), ZLint (X.509 conformance linter), and supporting utilities (ZCertificate, ZAnnotate, ZIterate, ZBlocklist, ZTee, ZSchema, mrt2json). The project distributes all tools freely via GitHub under an open-source license and exposes collected scan data through Scans.IO.

The project's served users are academic and security researchers performing Internet-wide studies of vulnerabilities, defensive-mechanism adoption, the HTTPS certificate ecosystem, DNS behavior, ICS exposure, and botnet behavior; its measured impact includes more than 500 citing academic papers and use as the underlying scanner for the Censys search engine and more than a dozen attack-surface management and security ratings companies. The business model is non-commercial: there is no pricing, no revenue line, no venture or corporate ownership, and continued development is supported by National Science Foundation (NSF) grant funding. The legal entity behind the project is "The ZMap Team," reachable at [email protected], and the 2024 'Ten Years of ZMap' retrospective at ACM IMC signals an active, mature research program rather than a growth-stage commercial venture.

Name

ZMap Project

Legal name

The ZMap Team

Website

https://zmap.io

Company type

Private

Founded year

2013

Operating status

Operating

Short description

The ZMap Project is an open-source research initiative that builds Internet-wide network measurement tools (ZMap, ZGrab, ZDNS, LZR, ZLint) for academic and security researchers, supported by NSF funding and maintained by the University of Michigan team behind Censys.

Ownership category

akta.pro rank

Product category

Network Measurement Tools

NAICS

Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)

SIC

Computer Communications Equipment (3576)

akta.pro primary industry

Infrastructure & Network Monitoring (NPM/NPMD) (HDABAJAA)

akta.pro secondary industry

Fault & Performance Monitoring (SNMP/Telemetry/APM for Networks) (HDAFAMAA)

Keywords

• Network scanning tools
• Internet measurement
• Security research
• Open source scanning
• Host discovery

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Operations

Distribution channels1 record

Marketing channels3 records

Core offering

The ZMap Project develops and distributes a suite of open-source measurement tools that enable researchers to perform large-scale studies of hosts and services on the public Internet. The flagship ZMap single-packet network scanner can survey the entire IPv4 address space on a single port in under 45 minutes, and is complemented by ZGrab (application-layer scanner), ZDNS (active DNS toolkit), LZR (protocol identification), ZCrypto and ZLint (TLS/X.509 analysis), plus supporting utilities. All tools are freely distributed via GitHub and supported by National Science Foundation (NSF) funding.

Product overview

The ZMap Project is a suite of open-source Internet measurement tools for performing large-scale studies of hosts and services on the public Internet. The core offering includes ZMap (fast single-packet network scanner), ZGrab (stateful application-layer scanner), and ZDNS (DNS lookup utility). These primary tools work together: ZMap performs initial network-level scanning, LZR identifies protocols, ZGrab performs deeper application-layer scanning, and ZDNS handles DNS lookups. Supporting the core suite are cryptographic libraries (ZCrypto for TLS/X.509), certificate validation tools (ZLint, ZCertificate), and data processing utilities (ZAnnotate, ZIterate, ZBlocklist, ZTee, ZSchema, mrt2json). The project provides open-source tools primarily distributed via GitHub, with research support from the National Science Foundation (NSF).

Differentiator

Problem solved

Functional benefit

Brands

• ZMap: A fast single-packet network scanner optimized for Internet-wide network surveys. Can scan the entire public IPv4 address space on a single port in under 45 minutes on a gigabit connection.
• ZGrab
• ZDNS
• ZCrypto
• ZLint
• LZR

Products and services

• ZMap Fast single-packet network scanner optimized for Internet-wide network surveys. On a gigabit connection, it can scan the entire public IPv4 address space on a single port in under 45 minutes; with a 10gigE connection and PF_RING, it can scan in 5 minutes.
• ZGrab Stateful application-layer scanner written in Go. Supports HTTP, HTTPS, SSH, Telnet, FTP, SMTP, POP3, IMAP, Modbus, BACNET, Siemens S7, and Tridium Fox protocols, and works in tandem with ZMap to perform TLS connections and collect application-layer data.
• ZDNS Utility for performing fast DNS lookups, such as completing A lookups for all names in a zone file or collecting CAA records for large numbers of websites. Contains its own recursive resolver and supports A, AAAA, ANY, AXFR, CAA, CNAME, DMARC, MX, NS, PTR, TXT, SOA, and SPF records.
• LZR Scanner that efficiently identifies what protocol an Internet service runs. Identifies 99% of unexpected Internet services in five handshakes and runs as a shim between ZMap and ZGrab.
• ZCrypto TLS and X.509 library for researchers, based on Go's standard library with support for a more extensive set of cipher suites, extra lenient ASN.1 and X.509 parsing, and handshake transcription.
• ZLint X.509 certificate linter that checks for conformity with X.509 RFCs, CA/Browser Forum baseline requirements, root store policies, and ETSI standards.
• ZCertificate Command-line utility that parses X.509 certificates, performs browser validation and ZLint tests, and produces a JSON encoding of the certificate.
• ZAnnotate Annotates IPs with additional metadata such as Maxmind GeoIP2 locations and routing data from TABLE_DUMPv2 MRT files.
• ZSchema High-level programming language for describing database schemas. Schemas can be used to validate datasets and be compiled into schemas for other databases.

Quantifiable outcome

• Scans entire public IPv4 address space on a single port in under 45 minutes on gigabit connection
• +3 more outcomes

Segments1 record

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration4 records

Feature12 records

Scale indicators2 records

Recent moves6 records

Expansion highlights4 records

Emerging players

• SecurityScorecard: SecurityScorecard is a security ratings provider that collects external attack-surface data. It is part of the same ratings ecosystem that ZMap is reported to power.
• Bitsight: Bitsight builds continuous security ratings using large-scale remote sensing of the public internet, conceptually adjacent to ZMap's measurement data and the broader ratings industry it powers.

Regional players

• FOFA: FOFA is a Chinese internet-wide search engine (similar to Censys/Shodan) that uses comparable scanning methodologies and is a regional alternative in the same measurement category.

Direct peers

• Masscan: Masscan is an open-source, high-speed TCP port scanner often cited alongside ZMap as the leading fast internet-scale scanning tool. It competes on the same user-space, full-IPv4-scan use case.
• Censys: Censys is the most direct peer: built on the ZMap/ZGrab stack, it provides a commercial search engine for internet-wide host and certificate data, monetizing the same scanning foundation that ZMap created.
• Project Sonar (Rapid7): Rapid7's Project Sonar performs internet-wide scanning and publishes datasets similar to ZMap, sharing the same threat-research and asset-discovery mission.
• Shadowserver Foundation: Shadowserver is a nonprofit security research organization that performs global internet scanning and serves vulnerable-population data, sharing ZMap's mission of open, public-interest measurement.
• Shodan: Shodan is the original internet-wide scanning and search service. It overlaps directly with ZMap in mission (mapping internet-exposed hosts) and is a primary alternative for researchers and security teams.
• Expanse (Palo Alto Networks Cortex Xpanse): Expanse is an attack-surface management platform that depends on the same kind of internet-wide scanning data ZMap produces, making it a downstream commercial analog.

Broad incumbents

• Nmap: Nmap is the broad incumbent in network scanning, offering deeper per-host enumeration but at lower speed than ZMap. It is the most widely deployed tool in the same category and often used complementarily.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/zmap

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ZMap Project